By monitoring a communication executed among a plurality of information processing devices in a computer system including a personal computer (PC), a server device, and the like, an abnormality and the like exemplified below can be found.                An abnormality occurring in a computer system,        An unauthorized deed to a computer system, and        An attack to a computer system.        
A communication is not necessarily a communication executed between a plurality of information processing devices, and may be, for example, a communication executed by processes inside an information processing device.
Hereinafter, in the present application, for convenience of explanation, the above-described abnormality, unauthorized deed, attack, and the like are referred to as “abnormality”.
PTL 1 or PTL 2 discloses a monitoring device which monitors an operation state relating to an information processing device in an information processing system. In addition, PTL 3 to 6 discloses a display device or the like capable of displaying a state relating to an information processing system. Hereinafter, each of the devices disclosed in PTL 1 to 6 will be described.
PTL 1 discloses a failure information display device that displays operating conditions of devices to be monitored (hereinafter, referred to as “target device”). The failure information display device includes an operation monitoring unit and a monitoring screen unit. The operation monitoring unit acquires each of operating conditions of a plurality of target devices, and transmits the acquired information to the monitoring screen unit. The monitoring screen unit receives the information and displays the received information on a display unit. In this case, the monitoring screen unit adjusts the number of pixels of the indicator representing the target device, based on the number of pixels of the display unit and the number of target devices.
PTL 2 discloses a monitoring state display device which displays an index representing a target device in a display region. The monitoring state display device includes usage index number determination means, monitoring target allocation means, and display control means. The usage index number determination means determines the number of indices to be used for displaying a target device having a certain degree of importance, based on a degree of importance of a predetermined target device. Next, the monitoring target allocation means allocates the number of the indices substantially equally to a target device having a certain degree of importance. The display control means displays the target device by the number of allocated indices.
PTL 3 discloses a compression encoding device (or a decoding device) which reduces processing in converting the image size. The compression encoding device has image size conversion means, input size adjustment means, and encoding means. The image size conversion means converts input image so as to match the display size, based on a pattern scan signal designating a display size at the time of displaying and an image aspect ratio at the time of decoding. The input size adjusting means adds partial image to be removed after decoding to an image generated by the image size conversion means to generate an image in which the image size of the input image has been adjusted to the encoded image size. Encoding means encodes an image generated by the image size conversion means, a pattern scan signal and an aspect ratio presentation signal to generate a bit stream signal.
PTL 4 discloses a monitoring program in which the cause thereof can be specified even when a communication abnormality occurs at an application level. The monitoring program has a detection function, a management function, a result display function, and an abnormality display function. The detection function detects whether or not each network device included in a plurality of network devices is operating normally. The result display function displays a detection result by the detection function on a display. The management function receives a notification message transmitted by a computer to be monitored and manages the received notification message when the occurrence frequency of a network device which is not operating normally exceeds a specified value. For each message managed by the management function, the abnormality display function displays information capable of identifying a computer which has issued the message on the display.
PTL 5 discloses a relationship display device capable of displaying a relationship between two elements and displaying a relationship between the two elements and a group including each of the two element. In the relationship display device, a plurality of circular regions each representing elements in a first set are displayed, and a node representing a second set and an arc representing a group in which the second group is classified are further displayed. The relationship display device displays a relationship between first elements included in the first set and second elements included in the second set by using an arc connecting an arc representing a group to which the second element belongs and a circular region. The relationship display device displays a relationship between a first element included in the first set and a group into which the second group is classified by using an arc connecting the circular region and the node.
PTL 6 discloses a hierarchical presentation device capable of displaying a tree structure having a deep hierarchy. The hierarchy presentation device has a set storing means, a tree structure storage means, a node instruction means, a node selection means, a figure generation means, a list generation means, and a presentation means. Element sets are stored in the set storage means. In the tree structure storage means, the tree structure data in which the hierarchical relationship regarding the element set held by the set storage means is expressed using a node and a link are stored. The node instruction means instructs whether or not to display a node included in the tree structure data stored in the tree structure storage means. The node selection means selects a target node to be displayed in detail from the tree structure data. The figure generation means extracts the node instructed to be displayed by the node instruction means and generates a tree structure drawing by using the extracted node. The list generation means generates a list of information elements corresponding to the target node selected by the node selection means. The information presentation means presents information in which the tree structure drawing and the list generated by the list generation means are associated with each other.